EUVD-2026-12417
GHSA-44mv-jq72-gj49
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory ID: MMSA-2026-00572
AnalysisAI
Mattermost fails to properly bound memory allocation when processing PSD (Photoshop) image files, allowing authenticated attackers to exhaust server memory and trigger denial of service by uploading a specially crafted PSD file. The vulnerability affects Mattermost versions 11.3.0 and earlier, 11.2.2 and earlier, and 10.11.10 and earlier. With a CVSS score of 4.3 and a low attack complexity requirement, this represents a moderate but exploitable risk for organizations running affected versions where user file upload is permitted.
Technical ContextAI
The vulnerability exists in Mattermost's image processing pipeline, specifically in the handling of Photoshop (PSD) files during file upload and validation. The root cause is classified under CWE-789 (Memory Allocation with Excessive Size Value), which occurs when the application fails to validate or limit the size of memory allocations before processing untrusted input. The PSD file format is complex and supports multiple layers, channels, and metadata; attackers can craft malicious PSD files with exaggerated dimension or layer count values that cause the image processing library to allocate excessive memory without proper bounds checking. This affects Mattermost's file upload and image processing components across versions 11.3.x, 11.2.x, and 10.11.x product lines. The affected CPE identifiers are cpe:2.3:a:mattermost:mattermost_server:*:* across the vulnerable version ranges.
RemediationAI
Upgrade Mattermost Server to version 11.3.1 or later for the 11.3.x branch, version 11.2.3 or later for the 11.2.x branch, or version 10.11.11 or later for the 10.11.x branch. Refer to the official Mattermost security advisory (MMSA-2026-00572) at https://mattermost.com/security-updates/ for detailed patching instructions and compatibility notes. As a temporary mitigation prior to patching, disable file uploads via Mattermost's configuration settings or restrict the feature to trusted users only. Additionally, implement OS-level memory limits and resource quotas on the Mattermost process using container memory limits (if deployed in Docker/Kubernetes) or cgroups to prevent a single malicious upload from exhausting all available memory and impacting other services. Monitor Mattermost logs for repeated image processing errors or unusual memory consumption patterns that may indicate exploitation attempts.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today